After you restart the system, you receive lots of email messages for old SQL Server alerts. The alerts date back to the oldest messages in the Application event log.
Additionally, the following messages are logged:
In the SQLAgent.out file
<DateTime> - ! [LOG] Unable to read local eventlog (reason: The RPC server is unavailable)
<DateTime> - ! [LOG] Unable to read local eventlog (reason: The handle is invalid)
<DateTime> - + [LOG] Successfully re-opened the local eventlog - NOTE: Some events may have been missed
In the Windows System event log file
<DateTime> Information server_name. 7036 Service Control Manager N/A N/A The Windows Event Log service entered the stopped state.
<DateTime> Information server_name. 7036 Service Control Manager N/A N/A The Windows Event Log service entered the running state.
The Application event log was configured to have a large maximum log size, either through a Group Policy Object (GPO) setting or a Local setting. When you examine the SQL Server Agent log, you see that at some time shortly after a restart, the handle to the event log is lost. When the handle is lost, the Alert Engine "loses its place" in the event log and sends emails for ALL errors (for which there are alerts defined) in the Application event log after the new event log handle is obtained.
This fix is included in the following updates:
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.